GitHub - johnnyjoy/nginx-micro: Ultra-minimal, multi-architecture, static NGINX container—perfect for secure, small HTTP serving behind a reverse proxy.

Ultra-minimal, statically-linked, multi-architecture NGINX Docker images.

A blazing-fast, container-native NGINX image—just hundreds of kilobytes—with no shell, no package manager, and no attack surface beyond static serving and FastCGI. Purpose-built for modern container stacks, edge deployments, and anyone who wants a rock-solid, tiny HTTP server.

🚀 Supported Platforms

Note: UPX-compressed images (-upx tags) are only published for platforms supported by UPX on Alpine Linux.

🏷️ Image Tags & Feature Matrix

Multiple image variants are published for different use cases. Choose the tag that matches your needs:

^† UPX-compressed images (-upx tags) are not built for s390x or riscv64, since UPX does not support them on Alpine.

📦 How Does the Size Compare?

That’s up to 160× smaller than the official nginx images!

⚡️ Why nginx-micro?

• FROM scratch: No shell, no package manager, no interpreter. Zero bloat.
• Attack surface: Minimized. Only HTTP and FastCGI (for PHP) are supported by default.
• Security: GPG-verified source, statically linked, no extraneous libraries.
• Multi-arch: Works on virtually any Linux system—cloud, Pi, mainframe, or edge.
• Logs to stdout/stderr: Perfect for Docker/Kubernetes observability.
• Plug-and-play config: Use the included config, or mount your own.
• Built for insecure HTTP: Use behind any SSL-terminating reverse proxy (Caddy, Traefik, HAProxy, nginx, Cloudflare, etc.).
• SSL/TLS, gzip, and SSI: Optional tags (-ssl, -gzip, -ssi, and -upx variants) for more features.

🛡️ Intended Use

• NOT for direct SSL/public internet use by default!

  • The -ssl tags add built-in HTTPS, but it’s still recommended to use a reverse proxy for cert management.

• Ideal for:

  • Static sites and health checks
  • PHP apps via FastCGI (php-fpm)
  • Serving assets in microservices
  • Demo, staging, CI pipelines
  • Ultra-lightweight edge deployments

🏁 Quick Start

Serve static files from your current directory:

docker run --rm -p 8080:80 \
  -v $(pwd):/www \
  tigersmile/nginx-micro

Open http://localhost:8080 in your browser.

Mount your own nginx.conf for full control:

docker run --rm -p 8080:80 \
  -v $(pwd)/nginx.conf:/conf/nginx.conf:ro \
  -v $(pwd)/site:/www \
  tigersmile/nginx-micro

Use with PHP-FPM (e.g., WordPress/Drupal):

# docker-compose.yml
version: "3"
services:
  nginx:
    image: tigersmile/nginx-micro
    ports:
      - "8080:80"
    volumes:
      - ./conf:/conf
      - ./www:/www
    depends_on:
      - php-fpm
    networks: [ web ]
  php-fpm:
    image: php:fpm
    volumes:
      - ./www:/www
    networks: [ web ]
networks:
  web:

📝 Default nginx.conf

user  nginx;
worker_processes  1;
error_log  /dev/stdout warn;
pid        /nginx.pid;

events { worker_connections  1024; }

http {
    include       mime.types;
    default_type  application/octet-stream;
    access_log    /dev/stdout;

    sendfile      on;
    keepalive_timeout  65;

    server {
        listen       80 default_server;
        server_name  _;

        root   /www;
        index  index.html index.php;

        location / {
            try_files $uri $uri/ =404;
        }

        # For PHP-FPM
        location ~ \.php$ {
            fastcgi_split_path_info ^(.+\.php)(/.+)$;
            fastcgi_param HTTP_PROXY "";
            fastcgi_pass   php-fpm:9000;
            fastcgi_index  index.php;
            include        fastcgi_params;
        }
    }
}

🏷️ Tag and Feature Reference

What’s a “UPX platform”? Currently: amd64, arm64, arm/v7, 386, ppc64le (but not s390x or riscv64).

⚙️ What’s Included / Not Included

🔒 Security Notes

• Runs as non-root (nginx, uid 101) by default.

  • Enforced by USER 101:101 in the Dockerfile and /etc/passwd.
  • No privileged capabilities.
  • Cannot bind to ports below 1024 unless run as root.

• No shell or package manager—cannot be “container escaped” by shell exploits.

• No writable filesystem, no interpreters.

Note: If you need to bind to privileged ports (like 80/443) on a host, you may override the user with --user root or by building your own image, but this is not recommended for security reasons.

🏗️ Building Yourself

Requires Docker with Buildx and QEMU (for multi-arch):

(Uses included docker-bake.hcl for all architectures and tags.)

🤝 Contribute & Contact

• Issues and PRs welcome! GitHub repo
• Suggestions for features or new use-cases? Open an issue!
• Show off your usage or share feedback—we want to hear from you!

📣 Why not just use the official nginx image?

• Ours is up to 160× smaller.
• No shell, no bloat, no hidden dependencies.
• Perfect for CI, health checks, microservices, edge, and cloud.

Ultra-minimal nginx—secure, fast, tiny, everywhere.

If you find this useful, star the repo, tell a friend, and help spread the word! (Project by johnnyjoy.)